Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,114cataloged exploits
31,649CVEs with public exploitation
0lab-tested
13,116 exploits
GitHub PoC
One-command scanner for the Mini Shai-Hulud npm supply-chain worm (CVE-2026-45321). Detect before rotating tokens.
CVE-2026-45321CRITICALunder attackransomware20 May 2026
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
78RISK
open
GitHub PoC
yusufdalbudak/CVE-2026-42945
CVE-2026-42945CRITICAL20 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC
POC for CVE-2026-30950 which allows session hijacking in AutoGpt
CVE-2026-30950HIGH20 May 2026
AutoGPT has Authenticated Session Hijacking via IDOR
41RISK
open
GitHub PoC
A small script to apply Yellowkey mitigation based on CVE-2026-45585 instructions
CVE-2026-45585MEDIUM20 May 2026
Windows BitLocker Security Feature Bypass Vulnerability
33RISK
open
GitHub PoC3
CVE-2026-42945 - NGINX Rift Toolkit
CVE-2026-42945CRITICAL20 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC
DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
CVE-2026-31635HIGH20 May 2026
rxrpc: fix oversized RESPONSE authenticator length check
41RISK
open
GitHub PoC
The code for personally reproducing the corresponding vulnerability
CVE-2026-42271HIGHunder attack20 May 2026
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RISK
open
GitHub PoC
fevar54/FULL-ANALYSIS---CVE-2026-45829-ChromaDB-
CVE-2026-45829CRITICAL20 May 2026
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un
53RISK
open
GitHub PoC2
A Go implementation of fragnesia (CVE-2026-46300)
CVE-2026-46300HIGH20 May 2026
net: skbuff: preserve shared-frag marker during coalescing
41RISK
open
GitHub PoC1
CVE-2026-2587 PoC validator for Eclipse GlassFish EL Injection RCE in the admin console gadget.jsf handler. Safe authenticated vulnerability scanner for authorized testing.
CVE-2026-2587CRITICAL20 May 2026
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used
48RISK
open
GitHub PoC
Maxime288/Fragnesia-CVE-2026-46300
CVE-2026-46300HIGH20 May 2026
net: skbuff: preserve shared-frag marker during coalescing
41RISK
open
GitHub PoC
gitgudKrish/cve-2025-29927-nextjs
CVE-2025-29927CRITICAL20 May 2026
Authorization Bypass in Next.js Middleware
85RISK
open
GitHub PoC
Se realizó una evaluación de vulnerabilidades sobre una máquina virtual con Kali Linux utilizando un script detector para la vulnerabilidad Dirty Frag, asociada a las CVE-2026-43284 y CVE-2026-43500. Posteriormente se ejecutó un Proof of Concept (PoC) público escrito en lenguaje C para validar la posibilidad de realizar una escalada local
CVE-2026-43284HIGH20 May 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open
GitHub PoC
Exploit for CVE-2026-41651 - PackageKit TOCTOU Local Privilege Escalation (Pack2TheRoot)
CVE-2026-41651HIGH20 May 2026
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
41RISK
open
GitHub PoC
POC_CVE-2026-35037
CVE-2026-35037HIGH20 May 2026
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
41RISK
open
GitHub PoC
MGTx2/CVE-2026-39107
CVE-2026-39107MEDIUM20 May 2026
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails
33RISK
open
GitHub PoC
Exploit for DirtyDecrypt - CVE-2026-31635 Local Privilege Escalation
CVE-2026-31635HIGH20 May 2026
rxrpc: fix oversized RESPONSE authenticator length check
41RISK
open
GitHub PoC
A Go implementation of dirtyfrag (CVE-2026-43284 / CVE-2026-43500)
CVE-2026-43284HIGH20 May 2026
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open
GitHub PoC
a24ac1/CVE-2026-0740
CVE-2026-0740CRITICAL20 May 2026
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISK
open
GitHub PoC
imSre9/CVE-2026-42945
CVE-2026-42945CRITICAL19 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC1
RedCrazyGhost/CVE-2026-42945
CVE-2026-42945CRITICAL19 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC
NGINX CVE-2026-42945 一键修复脚本
CVE-2026-42945CRITICAL19 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC1
CVE-2026-34474: unauthenticated ETHCheat=1 requests leak the admin password and Wi-Fi PSK from ZTE H298A/H108N routers.
CVE-2026-34474HIGH19 May 2026
Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to
46RISK
open
GitHub PoC
Shell scanner for CVE-2026-31431 "Copy Fail" — a local privilege escalation via Linux kernel page cache corruption (algif_aead/AF_ALG). Checks kernel version, patch status, module state, setuid exposure and mitigations. Supports Debian 11–13 and Ubuntu 20.04–25.10. CI/CD-ready (exit codes + JSON output).
CVE-2026-31431HIGHunder attack19 May 2026
crypto: algif_aead - Revert to operating out-of-place
100RISK
open
GitHub PoC
rufflabs/CVE-2026-36748
CVE-2026-36748CRITICAL19 May 2026
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
48RISK
open
GitHub PoC5
CVE-2026-31635
CVE-2026-31635HIGH19 May 2026
rxrpc: fix oversized RESPONSE authenticator length check
41RISK
open
GitHub PoC
anonmrc/CVE-2026-34486-e-Tomcat-Tribes
CVE-2026-34486HIGH19 May 2026
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
61RISK
open
GitHub PoC
Exploit code for CVE-2026-42096 and CVE-2026-42097 allowing for arbitrary SQL command execution without authentication.
CVE-2026-42096HIGH19 May 2026
Broken Access Control in Sparx Pro Cloud Server
41RISK
open
GitHub PoC
CVE-2026-30691: Stored Cross-Site Scripting (XSS) in @cyntler/react-doc-viewer
CVE-2026-30691MEDIUM19 May 2026
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitra
33RISK
open
GitHub PoC1
POC_CVE-2026-45185 for nuclei-templates
CVE-2026-45185CRITICAL19 May 2026
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing p
48RISK
open

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.